An improper privilege management vulnerability in the CAFEHAUS API WordPress plugin allows unauthenticated attackers to reset user passwords and achieve full account takeover.

This vulnerability, categorized under CWE-269, occurs because the software lacks authentication and authorization checks during password updates, allowing unauthenticated attackers to modify credentials.

A successful exploit of this vulnerability could lead to complete administrative account takeover, granting malicious actors full control over the affected WordPress site. This results in severe business risks, including unauthorized data access, website defacement, and the deployment of malware. The CVSS score of 7.5 reflects the high severity of the flaw, driven by remote network exploitability and lack of required privileges.

Immediate Action: Disable and remove the CAFEHAUS API WordPress plugin immediately until a patched version is officially released by the vendor.

Proactive Monitoring: Review authentication logs and user account modification records for suspicious administrative password resets or unexpected new administrator accounts.

Compensating Controls: Implement a Web Application Firewall rule to block suspicious requests targeting the CAFEHAUS API plugin endpoints.

Public Exploit Available: No - As of the available data, there is no confirmed public exploit in the form of a Metasploit module or ExploitDB entry.

Security teams must treat this high severity vulnerability with extreme urgency given the potential for complete site compromise. Administrators should immediately deactivate the vulnerable CAFEHAUS API plugin and monitor logs closely for signs of unauthorized privilege escalation while awaiting vendor patches.